Satoshiscloset Wallet

Some pieces of information stored by the WLT mobile application were not erased from the device after a user successfully logged out. This could lead to the disclosure of sensitive information about the user. This increases the risk that sensitive information could be leaked if a device was lost. Note that this finding was only rated as low risk because no sensitive information was found in the information still present after the user logged out.

The iOS and Android applications were interacting with third party services located on different domains.

The WLT Android application is making use of the `androidx.security.crypto.MasterKeys` class. However, according to the official documentation this class was deprecated in favor of `androidx.security.crypto.MasterKey`. For more information, see: - https://developer.android.com/reference/kotlin/androidx/security/crypto/package-summary - https://developer.android.com/reference/kotlin/androidx/security/crypto/MasterKeys - https://developer.android.com/reference/kotlin/androidx/security/crypto/MasterKey.Builder - https://developer.android.com/jetpack/androidx/releases/security Other outdated software components such as `OkHTTP 4.9.1`, `wallet-core 3.0.4` and `react-native 0.66.4` were found in the codebase. The latest versions available at the time of conducting this pentest were 4.10.0, 3.0.8 and 0.70.4 respectively . For more information visit: - https://square.github.io/okhttp/changelogs/changelog_4x/ - https://github.com/trustwallet/wallet-core/releases - https://github.com/facebook/react-native/releases

The WLT iOS application used the data directory to store information related to the user, like the HTTP Cache, which contains session information and temporary files, but the protection classes associated to those items were not sufficiently secure. When a new file is created on the data directory, it is assigned a protection class by the application that creates it. Each class uses different policies to determine when the data is accessible. Data Protection is an encryption framework provided by Apple to offer file encryption capabilities to the file system. This framework is active by default although the default settings are rarely appropriate. The default option for items in the data directory is `NSFileProtectionCompleteUntilFirstUserAuthentication`. As the name implies, items are encrypted until the first time the user log in, then all files are saved in clear text.

The WLT mobile application lets the user set a weak PIN number such as 1111. Furthermore, it is possible to disable it so the application does not have any kind of protection. Finally, the PIN mechanism does not seem to have a reasonable limit of attempts; the source code suggested that 999 would be allowed (which are too much given that the PIN length is of only 4 digits and allows typical values): ```javascript delayBetweenAttempts={2000} maxAttempts={999} ```